a14fa40b174aa50e6ca01dcf32a346c1eae8737eb6ed93a558cdeb601b86986b

Resubmissions

09/06/2024, 10:21

09/06/2024, 10:21

09/06/2024, 10:08

max time kernel
91s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 10:21

Target
DLL/Qt5Core.dll
Size 4.9MB
Sample240609-md1b4aaa48
SHA256 85e29fd8a95f23a8af5ed0d0e93d18fcc30f95affbb75a1fcb20b873e8e5d8b0
MD5 aa6ce2c97b80c323cbe9f86dbd6d263e
SHA1 089f6915aa650b0cc7dcc53a7e4365310523dd68
SHA512 dd3e1684306624dbf0398021b1fa8833a348dec9271b5eb224c9a59877f832ce1aedb9c4f6ef84c061bf3585f3a5628e9f49296deab542b36ae3fa2230f3b417
SSDEEP 98304:D/cPFLQEJuMEGJsv6tWKFdu9C9Ed74Gx80MEcUsk80MEcUsk80ycUsk80M6Ou:DsRJsv6tWKFdu9C9y7g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4000	4404	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4404	4588	rundll32.exe	82
PID 4588 wrote to memory of 4404	4588	rundll32.exe	82
PID 4588 wrote to memory of 4404	4588	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\Qt5Core.dll,#1
  2⤵
  PID:4404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 676
    3⤵
    - Program crash
    PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4404 -ip 4404
1⤵
PID:2028